Missing installation secured

lib/travis/api/v3.rb

@@ -40,6 +40,7 @@ def location(env)
       JobUnfinished       = ClientError        .create('job still running, cannot remove log yet', status: 409)
       LogAlreadyRemoved   = ClientError        .create('log has already been removed', status: 409)
       LoginRequired       = ClientError        .create('login required', status: 403)
+      InstallationMissing = ClientError        .create('installation required', status: 403)
       MethodNotAllowed    = ClientError        .create('method not allowed', status: 405)
       NotImplemented      = ServerError        .create('request not (yet) implemented', status: 501)
       PrivateRepoFeature  = ClientError        .create('this feature is only available on private repositories and for Travis CI Enterprise customers', status: 403)

lib/travis/api/v3/services/repositories/for_current_user.rb

@@ -6,6 +6,7 @@ class Services::Repositories::ForCurrentUser < Service
 
     def run!
       raise LoginRequired unless access_control.logged_in?
+      raise InstallationMissing unless Travis.config.org? || access_control.user.vcs_type != 'GithubUser' || access_control.user.installation
       result query.for_member(access_control.user)
     end
   end

lib/travis/api/v3/services/repositories/for_owner.rb

@@ -5,6 +5,7 @@ class Services::Repositories::ForOwner < Service
     paginate(default_limit: 100)
 
     def run!
+      raise InstallationMissing unless Travis.config.org? || access_control.user.installation
       unfiltered = query.for_owner(find(:owner), user: access_control.user)
       result access_control.visible_repositories(unfiltered)
     end

spec/v3/services/repositories/filter_spec.rb

@@ -4,6 +4,7 @@
   let(:headers) { { 'HTTP_AUTHORIZATION' => "token #{token}" } }
 
   before { ActiveRecord::Base.connection.execute("truncate repositories cascade") }
+  before { Travis::API::V3::Models::Installation.create(owner_type: 'User', owner_id: user.id, github_id: 789) }
 
   describe 'name_filter' do
     let(:web_repo)  { FactoryBot.create(:repository, name: 'travis-web') }

spec/v3/services/repositories/for_current_user_spec.rb

@@ -6,6 +6,7 @@
   let(:token)   { Travis::Api::App::AccessToken.create(user: repo.owner, app_id: 1)             }
   let(:headers) {{ 'HTTP_AUTHORIZATION' => "token #{token}"                                    }}
   before        { Travis::API::V3::Models::Permission.create(repository: repo, user: repo.owner, pull: true, push: true, admin: true) }
+  before        { Travis::API::V3::Models::Installation.create(owner_type: 'User', owner_id: repo.owner.id, github_id: 789) }
   before        { repo.update_attribute(:private, true)                                         }
   after         { repo.update_attribute(:private, false)                                        }
   before        { Travis::Features.activate_owner(:allow_migration, repo.owner) }

spec/v3/services/repositories/for_owner_spec.rb

@@ -11,6 +11,7 @@
   let(:token_collaborator)   { Travis::Api::App::AccessToken.create(user: Travis::API::V3::Models::User.find_by_login('johndoe'), app_id: 1) }
   let(:headers_collaborator) {{ 'HTTP_AUTHORIZATION' => "token #{token_collaborator}"                        }}
   before        { Travis::API::V3::Models::Permission.create(repository: repo, user: repo.owner, pull: true) }
+  before        { Travis::API::V3::Models::Installation.create(owner_type: 'User', owner_id: repo.owner.id, github_id: 789) }
   before        { repo.update_attribute(:private, true)                             }
   before        { repo.update_attribute(:current_build, build)                             }
   after         { repo.update_attribute(:private, false)                            }